{"id":"CVE-2026-4367","aliases":["ALPINE-CVE-2026-4367","AZL-90198","BELL-CVE-2026-4367","DEBIAN-CVE-2026-4367","EUVD-2026-37136","GHSA-c2rx-36v4-qc8g","MGASA-2026-0186","OESA-2026-2151","RHSA-2026:30354","RHSA-2026:47072","ROOT-OS-DEBIAN-11-CVE-2026-4367","SUSE-SU-2026:22121-1","UBUNTU-CVE-2026-4367","USN-8600-1","openSUSE-SU-2026:10608-1","openSUSE-SU-2026:20953-1"],"status":"published","title":"Libxpm: libxpm: denial of service via out-of-bounds read in xpm file parsing","description":"A flaw was found in libXpm. A local user with low privileges could exploit an Out-of-Bounds Read vulnerability in the `xpmNextWord()` function by processing a specially crafted or very small XPM (X PixMap) image file. This improper validation of file boundaries can cause an internal pointer to read beyond the file's end, leading to application crashes and Denial of Service conditions.","severity":{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00129,"percentile":0.02535,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-125"],"published":"2026-04-21T13:00:00Z","modified":"2026-11-06T10:04:55Z","fixes":[{"ecosystem":"Alpine:v3.20","package":"libxpm","fixed_in":["3.5.19-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"libxpm","fixed_in":["3.5.19-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"libxpm","fixed_in":["3.5.19-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"libxpm","fixed_in":["3.5.19-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"libxpm","fixed_in":["3.5.19-r0"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"libXpm","fixed_in":["3.5.19-1"],"sources":["osv"]},{"ecosystem":"Alpaquita:23","package":"libxpm","fixed_in":["3.5.19-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:25","package":"libxpm","fixed_in":["3.5.19-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"libxpm","fixed_in":["3.5.19-r0"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:23","package":"libxpm","fixed_in":["3.5.19-r0"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:25","package":"libxpm","fixed_in":["3.5.19-r0"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:stream","package":"libxpm","fixed_in":["3.5.19-r0"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"libxpm","fixed_in":["1:3.5.17-1+deb13u1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"libxpm","fixed_in":["1:3.5.19-1"],"sources":["osv"]},{"ecosystem":"Mageia:9","package":"libxpm","fixed_in":["3.5.15-1.2.mga9"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP4","package":"libXpm","fixed_in":["3.5.13-4.oe2003sp4"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP4","package":"libXpm","fixed_in":["3.5.13-6.oe2203sp4"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS","package":"libXpm","fixed_in":["3.5.17-2.oe2403sp3"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP1","package":"libXpm","fixed_in":["3.5.17-2.oe2403sp1"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP3","package":"libXpm","fixed_in":["3.5.17-2.oe2403sp3"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"libXpm","fixed_in":["0:3.5.17-7.2.hum1"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"libXpm-devel","fixed_in":["0:3.5.17-7.2.hum1"],"sources":["osv"]},{"ecosystem":"Root:Debian:11","package":"libxpm","fixed_in":["1:3.5.12-1.1+deb11u1.aikido.2","1:3.5.12-1.1+deb11u1.aikido.3","1:3.5.12-1.1+deb11u1.aikido.4","1:3.5.12-1.1+deb11u1.root.io.1"],"sources":["osv"]},{"ecosystem":"Root:Debian:11","package":"rootio-libxpm","fixed_in":["1:3.5.12-1.1+deb11u1.aikido.2","1:3.5.12-1.1+deb11u1.aikido.3","1:3.5.12-1.1+deb11u1.aikido.4","1:3.5.12-1.1+deb11u1.root.io.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"libXpm","fixed_in":["3.5.17-160000.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"libXpm","fixed_in":["3.5.17-160000.3.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"libxpm","fixed_in":["1:3.5.12-1ubuntu0.22.04.3"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"libxpm","fixed_in":["1:3.5.17-1ubuntu0.24.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.04:LTS","package":"libxpm","fixed_in":["1:3.5.17-1ubuntu0.26.04.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"libXpm","fixed_in":["3.5.18-2.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 16.0","package":"libXpm","fixed_in":["3.5.17-160000.3.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.20","package":"libxpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.19-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"libxpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.19-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"libxpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.19-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"libxpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.19-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"libxpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.19-r0"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"libXpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.19-1"}]}]},{"source":"osv","ecosystem":"Alpaquita:23","package":"libxpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.5.14-r0"},{"fixed":"3.5.19-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:25","package":"libxpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.5.17-r0"},{"fixed":"3.5.19-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"libxpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.5.14-r0"},{"fixed":"3.5.19-r0"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:23","package":"libxpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.5.14-r0"},{"fixed":"3.5.19-r0"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:25","package":"libxpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.5.17-r0"},{"fixed":"3.5.19-r0"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:stream","package":"libxpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.5.14-r0"},{"fixed":"3.5.19-r0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"libxpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:3.5.12-1.1","1:3.5.12-1.1+deb12u1","1:3.5.17-1","1:3.5.19-1","1:3.5.20-1"]},{"source":"osv","ecosystem":"Debian:13","package":"libxpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.17-1+deb13u1"}]}],"versions":["1:3.5.17-1"]},{"source":"osv","ecosystem":"Debian:14","package":"libxpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.19-1"}]}],"versions":["1:3.5.17-1"]},{"source":"osv","ecosystem":"Mageia:9","package":"libxpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.15-1.2.mga9"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"libXpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.13-4.oe2003sp4"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"libXpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.13-6.oe2203sp4"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"libXpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.17-2.oe2403sp3"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"libXpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.17-2.oe2403sp1"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"libXpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.17-2.oe2403sp3"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"libXpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.17-7.2.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"libXpm-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.17-7.2.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"libXpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.19-4.hum1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"libXpm-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.19-4.hum1"}]}],"bundled":2},{"source":"osv","ecosystem":"Root:Debian:11","package":"libxpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.12-1.1+deb11u1.aikido.2"},{"fixed":"1:3.5.12-1.1+deb11u1.aikido.3"},{"fixed":"1:3.5.12-1.1+deb11u1.aikido.4"},{"fixed":"1:3.5.12-1.1+deb11u1.root.io.1"}]}]},{"source":"osv","ecosystem":"Root:Debian:11","package":"rootio-libxpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.12-1.1+deb11u1.aikido.2"},{"fixed":"1:3.5.12-1.1+deb11u1.aikido.3"},{"fixed":"1:3.5.12-1.1+deb11u1.aikido.4"},{"fixed":"1:3.5.12-1.1+deb11u1.root.io.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"libXpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.17-160000.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"libXpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.17-160000.3.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"libxpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:3.5.10-1","1:3.5.10-1ubuntu0.1","1:3.5.10-1ubuntu0.1+esm1","1:3.5.10-1ubuntu0.1+esm2"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"motif","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.3.4-4","2.3.4-5","2.3.4-5ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"libxpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:3.5.11-1","1:3.5.11-1ubuntu0.16.04.1","1:3.5.11-1ubuntu0.16.04.1+esm1","1:3.5.11-1ubuntu0.16.04.1+esm2"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"motif","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.3.4-8ubuntu1","2.3.4-9","2.3.4-10"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"libxpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:3.5.12-1","1:3.5.12-1ubuntu0.18.04.2","1:3.5.12-1ubuntu0.18.04.2+esm1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"motif","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.3.7-2","2.3.8-1","2.3.8-2","2.3.8-2build1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"libxpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:3.5.12-1","1:3.5.12-1ubuntu0.20.04.1","1:3.5.12-1ubuntu0.20.04.2"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"motif","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.3.8-2build1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"libxpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.12-1ubuntu0.22.04.3"}]}],"versions":["1:3.5.12-1","1:3.5.12-1build1","1:3.5.12-1build2","1:3.5.12-1ubuntu0.22.04.1","1:3.5.12-1ubuntu0.22.04.2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"motif","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.3.8-3"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"libxpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.17-1ubuntu0.24.04.1"}]}],"versions":["1:3.5.12-1.1ubuntu1","1:3.5.17-1","1:3.5.17-1build1","1:3.5.17-1build2"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"motif","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.3.8-3","2.3.8-3.1","2.3.8-3.1build1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"libxpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:3.5.17-1build2"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"motif","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.3.8-4","2.3.8-5"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"motif","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.3.8-5build1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"libxpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.17-1ubuntu0.26.04.1"}]}],"versions":["1:3.5.17-1build2","1:3.5.17-1build3"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"motif","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.3.8-5","2.3.8-5build1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"libxpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.12-1ubuntu0.22.04.3"}]}],"versions":["1:3.5.12-1","1:3.5.12-1build1","1:3.5.12-1build2","1:3.5.12-1ubuntu0.22.04.1","1:3.5.12-1ubuntu0.22.04.2"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"libxpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.17-1ubuntu0.24.04.1"}]}],"versions":["1:3.5.12-1.1ubuntu1","1:3.5.17-1","1:3.5.17-1build1","1:3.5.17-1build2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"libxpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.17-1ubuntu0.26.04.1"}]}],"versions":["1:3.5.17-1build2","1:3.5.17-1build3"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"libXpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.18-2.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"libXpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.17-160000.3.1"}]}]}],"products":[{"vendor":"red hat","product":"red hat enterprise linux 10"},{"vendor":"red hat","product":"red hat enterprise linux 6"},{"vendor":"red hat","product":"red hat enterprise linux 7"},{"vendor":"red hat","product":"red hat enterprise linux 8"},{"vendor":"red hat","product":"red hat enterprise linux 9"},{"vendor":"red hat","product":"red hat hardened images"}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2026:30354","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:47072","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-4367","tags":["vdb-entry","x_refsource_REDHAT","advisory","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2448984","tags":["issue-tracking","x_refsource_REDHAT","report"]},{"url":"https://gitlab.freedesktop.org/xorg/lib/libxpm/-/commit/5448e1bd","tags":["fix","article"]},{"url":"https://seclists.org/oss-sec/2026/q2/192","tags":["web","article"]},{"url":"http://www.openwall.com/lists/oss-security/2026/04/21/3","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-4367","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-c2rx-36v4-qc8g"},{"url":"https://security.alpinelinux.org/vuln/CVE-2026-4367","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2026-4367","tags":["advisory"]},{"url":"https://access.redhat.com/downloads/content/package-browser/","tags":["web"]},{"url":"https://catalog.redhat.com/software/containers/","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/4xxx/CVE-2026-4367.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-4367","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0186.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=35415","tags":["report"]},{"url":"https://www.openwall.com/lists/oss-security/2026/04/21/3","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/RVKVREGNUTRNFASWOP3IK7BSE3RXDHLZ/","tags":["web"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2151","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/","tags":["article"]},{"url":"https://images.redhat.com/","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_30354.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-4367","tags":["advisory","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-94287","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_47072.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2542381","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-94287","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-94287","tags":["advisory"]},{"url":"https://gitlab.freedesktop.org/xorg/lib/libxpm/-/merge_requests/32/diffs?commit_id=3a68f818b1628d7ad96245b0f4d15a32a015b0ab","tags":["article"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202622121-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1260928","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-4367","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2026-4367","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8600-1","tags":["advisory"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-4367","title":"Libxpm: libxpm: denial of service via out-of-bounds read in xpm file parsing","description":"A flaw was found in libXpm. A local user with low privileges could exploit an Out-of-Bounds Read vulnerability in the `xpmNextWord()` function by processing a specially crafted or very small XPM (X PixMap) image file. This improper validation of file boundaries can cause an internal pointer to read beyond the file's end, leading to application crashes and Denial of Service conditions.","status":"published","published":"2026-06-16T16:50:15.037Z","modified":"2026-11-05T20:37:18.605Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"cna"}],"cwes":["CWE-125"],"updated_at":"2026-11-05T21:25:06.152449Z"}],"euvd":[{"id":"EUVD-2026-37136","description":"A flaw was found in libXpm. A local user with low privileges could exploit an Out-of-Bounds Read vulnerability in the `xpmNextWord()` function by processing a specially crafted or very small XPM (X PixMap) image file. This improper validation of file boundaries can cause an internal pointer to read beyond the file's end, leading to application crashes and Denial of Service conditions.","status":"published","published":"2026-06-16T16:50:15Z","modified":"2026-11-05T20:37:18Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-05T22:02:10.772181Z"}],"ghsa":[{"id":"GHSA-c2rx-36v4-qc8g","title":"A flaw was found in libXpm. A local user with low privileges could exploit an Out-of-Bounds Read...","description":"A flaw was found in libXpm. A local user with low privileges could exploit an Out-of-Bounds Read vulnerability in the `xpmNextWord()` function by processing a specially crafted or very small XPM (X PixMap) image file. This improper validation of file boundaries can cause an internal pointer to read beyond the file's end, leading to application crashes and Denial of Service conditions.","status":"published","published":"2026-06-16T21:31:57Z","modified":"2026-07-28T12:31:19Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T15:09:51.995252Z"}],"nvd":[{"id":"CVE-2026-4367","description":"A flaw was found in libXpm. A local user with low privileges could exploit an Out-of-Bounds Read vulnerability in the `xpmNextWord()` function by processing a specially crafted or very small XPM (X PixMap) image file. This improper validation of file boundaries can cause an internal pointer to read beyond the file's end, leading to application crashes and Denial of Service conditions.","status":"published","published":"2026-06-16T19:16:59.233Z","modified":"2026-11-05T21:18:50.77Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"secondary"}],"cwes":["CWE-125"],"updated_at":"2026-11-05T23:57:19.370761Z"}],"osv":[{"id":"ALPINE-CVE-2026-4367","description":"A flaw was found in libXpm. A local user with low privileges could exploit an Out-of-Bounds Read vulnerability in the `xpmNextWord()` function by processing a specially crafted or very small XPM (X PixMap) image file. This improper validation of file boundaries can cause an internal pointer to read beyond the file's end, leading to application crashes and Denial of Service conditions.","status":"published","published":"2026-06-16T19:16:59.233Z","modified":"2026-10-01T02:17:49.302974541Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:27:50.764331Z"},{"id":"BELL-CVE-2026-4367","status":"published","published":"2026-04-23T06:10:51.599578Z","modified":"2026-09-06T07:15:24.970351702Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:28:24.12174Z"},{"id":"CVE-2026-4367","title":"Libxpm: libxpm: denial of service via out-of-bounds read in xpm file parsing","description":"A flaw was found in libXpm. A local user with low privileges could exploit an Out-of-Bounds Read vulnerability in the `xpmNextWord()` function by processing a specially crafted or very small XPM (X PixMap) image file. This improper validation of file boundaries can cause an internal pointer to read beyond the file's end, leading to application crashes and Denial of Service conditions.","status":"published","published":"2026-06-16T16:50:15.037Z","modified":"2026-11-07T02:30:34.346722697Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-125"],"updated_at":"2026-11-07T03:08:05.437376Z"},{"id":"DEBIAN-CVE-2026-4367","description":"A flaw was found in libXpm. A local user with low privileges could exploit an Out-of-Bounds Read vulnerability in the `xpmNextWord()` function by processing a specially crafted or very small XPM (X PixMap) image file. This improper validation of file boundaries can cause an internal pointer to read beyond the file's end, leading to application crashes and Denial of Service conditions.","status":"published","published":"2026-06-16T19:16:59.233Z","modified":"2026-11-06T10:04:55.122290383Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-06T10:38:22.758306Z"},{"id":"OESA-2026-2151","title":"libXpm security update","description":"X.Org X11 libXpm runtime library\r\n\r\nSecurity Fix(es):\n\nA vulnerability was found in X.org libXpm up to 3.5.4. It has been classified as problematic.CWE is classifying the issue as CWE-125. The product reads data past the end, or before the beginning, of the intended buffer.This is going to have an impact on confidentiality.Upgrading to version 3.5.19 eliminates this vulnerability. Applying the patch 5448e1bd is able to eliminate this problem. The bugfix is ready for download at gitlab.freedesktop.org. The best possible mitigation is suggested to be upgrading to the latest version.(CVE-2026-4367)","status":"published","published":"2026-05-03T11:11:08Z","modified":"2026-08-18T01:19:50.619512113Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:46.087701Z"},{"id":"RHSA-2026:30354","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","status":"published","published":"2026-06-27T10:25:31Z","modified":"2026-10-06T10:31:23.140687096Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:19.963895Z"},{"id":"RHSA-2026:47072","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","status":"published","published":"2026-07-28T10:14:00Z","modified":"2026-09-29T10:57:36.964690479Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:20.984762Z"},{"id":"UBUNTU-CVE-2026-4367","description":"A flaw was found in libXpm. A local user with low privileges could exploit an Out-of-Bounds Read vulnerability in the `xpmNextWord()` function by processing a specially crafted or very small XPM (X PixMap) image file. This improper validation of file boundaries can cause an internal pointer to read beyond the file's end, leading to application crashes and Denial of Service conditions.","status":"published","published":"2026-04-21T13:00:00Z","modified":"2026-10-17T12:58:17.308595393Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T16:56:22.075798Z"},{"id":"AZL-90198","title":"CVE-2026-4367 affecting package libXpm for versions less than 3.5.19-1","description":"A flaw was found in libXpm. A local user with low privileges could exploit an Out-of-Bounds Read vulnerability in the `xpmNextWord()` function by processing a specially crafted or very small XPM (X PixMap) image file. This improper validation of file boundaries can cause an internal pointer to read beyond the file's end, leading to application crashes and Denial of Service conditions.","status":"published","published":"2026-06-16T19:16:59Z","modified":"2026-08-28T17:56:21.698601Z","updated_at":"2026-11-02T15:28:11.397546Z"},{"id":"MGASA-2026-0186","title":"Updated libxpm packages fix security vulnerability","description":"libXpm Out-of-bounds read in xpmNextWord(). (CVE-2026-4367)\n","status":"published","published":"2026-06-10T05:07:06Z","modified":"2026-06-10T05:15:04.459998937Z","updated_at":"2026-11-02T15:49:43.178336Z"},{"id":"openSUSE-SU-2026:10608-1","title":"libXpm-devel-3.5.18-2.1 on GA media","description":"These are all security issues fixed in the libXpm-devel-3.5.18-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-04-23T00:00:00Z","modified":"2026-04-24T08:15:54.839715Z","updated_at":"2026-11-02T16:58:38.415593Z"},{"id":"openSUSE-SU-2026:20953-1","title":"Security update for libXpm","description":"This update for libXpm fixes the following issue:\n\n- CVE-2026-4367: out-of-bounds read in `xpmNextWord()` (bsc#1260928).\n","status":"published","published":"2026-06-11T12:46:56Z","modified":"2026-06-16T18:24:43.590169444Z","updated_at":"2026-11-02T16:58:41.885092Z"},{"id":"ROOT-OS-DEBIAN-11-CVE-2026-4367","title":"CVE-2026-4367 in libxpm - Patched by Root","description":"Root has patched CVE-2026-4367 in the libxpm package for Root:Debian:11. Multiple fixed versions available.","status":"published","published":"2026-08-23T11:56:03Z","modified":"2026-08-23T12:30:03.452534889Z","updated_at":"2026-11-02T15:53:30.179841Z"},{"id":"SUSE-SU-2026:22121-1","title":"Security update for libXpm","description":"This update for libXpm fixes the following issue:\n\n- CVE-2026-4367: out-of-bounds read in `xpmNextWord()` (bsc#1260928).\n","status":"published","published":"2026-06-11T12:44:37Z","modified":"2026-06-17T18:24:24.323968386Z","updated_at":"2026-11-02T15:54:02.654057Z"},{"id":"USN-8600-1","title":"libxpm vulnerability","description":"Naoki Wakamatsu discovered that libXpm did not properly validate file\nboundaries when processing XPM image files. An attacker could possibly use\nthis issue to cause libXpm to crash, resulting in a denial of service.","status":"published","published":"2026-07-23T14:41:05Z","modified":"2026-07-24T01:35:03.100635581Z","updated_at":"2026-11-02T16:58:25.103481Z"}]}}